[I was a member of the team that created Aadhaar, and continue to stay involved in the creation and evangelisation of the India Stack. As a result, I take part in many conversations around personal identity data. I also believe that users must be able to control their data, and its use.
As a country, we are moving from a world of paper and registers to a new digital, online world. This is the right direction to go. But, issues around the use of personal identity data are beginning to grow, and it is time to consider ways to protect users, and to respect their trust. To this end, I thought that it would be worthwhile to use a simple use case – look at the essence of it, and explore these issues.]
Identity as a source of trust
To buy a SIM card, Ram provides an identity document. The agent copies this document. The telecom company keeps it as proof of KYC compliance. The company also creates a customer record and provides services to the customer. Ram follows a similar process for setting up many different types of relationships. For example, while banking or being employed.
Trusted identity information, and verification form the basis for setting up these relationships.
Ram may also have to prove his identity while using services. For example, when operating a bank account, or when entering an airport.
A trustworthy verification process allows for smooth access to services and transactions.
But, Ram risks misuse of his personal data in this process. Let’s look at these risks:
- The agent may keep an extra copy of his identity document.
- Someone may misuse his document to setup an account in his name without his knowledge.
- Someone may misuse his document to take over an existing relationship.
- Someone may steal his identity information from the company.
- Someone may be able to infer something about him from his behaviour across companies.
Identity theft, data leakage, and surveillance are not new risks, but they have become concerns with digitisation.
But, digital systems also provide better ways to protect Ram, and his data:
- Remove the need for an identity at all.
- Remove paper copies of the identity document – use a digital version, and protect it.
- Alert him on use of his identity
- Use different identity documents to prevent linkage.
- Strengthen current laws, or make new ones to dissuade bad behaviour.
Types of Data
Any conversation on the use of identity data would be incomplete without looking at the different types of data.
- Basic Identity attributes of a person. For Example, Name, Address
- Transaction Data. For example, purchase transactions, banking transactions, phone calls.
- Data Aggregates – Information based on a collection of data.
- Behavioural Data – Inferences from transaction data, possibly from different types of transactions.
All conversations around data use, consent, risks, and protection must take into account these different data types.
Interactions as a source of trust
As Ram uses the service, his trust in the reliability of service goes up. At the same time, the service provider trusts Ram more, and may increase various limits, etc.
This is true in other types of relationships as well, employees who stay longer are trusted more.
Aggregated transactions, and behavioural data also increase trust.
Role of consent
- Overly broad consent
- Click accept agreements which are not read
- Policies that may be modified without notification
The consent process needs to change. Users must know what to expect from a service provider, and be able to hold them accountable to meet these expectations.
Transparency as a source of trust
Certain services must be transparent to stakeholders and publish data. For instance, a company may publish salaries of top management to gain the trust of shareholders. Similarly, some public service providers may publish list of services delivered with beneficiary details.
In this context, I would like to frame the following sets of questions:
- Trust originates from identity verification, and interactions. Forgery and misrepresentation erode this trust. How do we enable the trust, even in the presence of intermediaries? How do we make this trust bi-directional, so that the user knows more about the company that he / she is dealing with?
- Employee records, customer lists, etc. contain identity information. How can companies protect these against theft, leakage and misuse? How can users ensure that their data is not stolen?
- How can companies inform users about the use of their personal data use, when asking for consent? How can users verify that the company is not doing anything different?
- How can public entities meet transparency requirements while being sensitive about personal data? How can users ensure that their data is not leaked? How can other stakeholders hold the service provider accountable with reduced data?
Looking forward to your answers and thoughts in the discussions below.